saa-c02-part-05

Question 1

A company’s operations team has an existing Amazon S3 bucket configured to notify an Amazon SQS queue when new objects are created within the bucket. The development team also wants to receive events when new objects are created. The existing operations team workflow must remain intact.
Which solution would satisfy these requirements?

1. Create another SQS queue. Update the S3 events in the bucket to also update the new queue when a new object is created.
2. Create a new SQS queue that only allows Amazon S3 to access the queue. Update Amazon S3 to update this queue when a new object is created.
3. Create an Amazon SNS topic and SQS queue for the bucket updates. Update the bucket to send events to the new topic. Updates both queues to poll Amazon SNS.
4. Create an Amazon SNS topic and SQS queue for the bucket updates. Update the bucket to send events to the new topic. Add subscriptions for both queues in the topic.

Answer 1

4. Create an Amazon SNS topic and SQS queue for the bucket updates. Update the bucket to send events to the new topic. Add subscriptions for both queues in the topic.

operations team + development team = 2 teams want events = fanout = SNS Topic

SQS ARN subscribes to a Topic

Question 2

An application runs on Amazon EC2 instances in private subnets. The application needs to access an Amazon DynamoDB table. What is the MOST secure way to access the table while ensuring that the traffic does not leave the AWS network?

1. Use a VPC endpoint for DynamoDB.
2. Use a NAT gateway in a public subnet.
3. Use a NAT instance in a private subnet.
4. Use the internet gateway attached to the VPC.

Answer 2

1. Use a VPC endpoint for DynamoDB.

application needs to access an Amazon DynamoDB = endpoint

Question 3

A company built an application that lets users check in to places they visit, rank the places, and add reviews about their experiences. The application is successful with a rapid increase in the number of users every month.
The chief technology officer fears the database supporting the current Infrastructure may not handle the new load the following month because the single Amazon RDS for MySQL instance has triggered alarms related to resource exhaustion due to read requests.
What can a solutions architect recommend to prevent service Interruptions at the database layer with minimal changes to code?

1. Create RDS read replicas and redirect read-only traffic to the read replica endpoints. Enable a Multi-AZ deployment.
2. Create an Amazon EMR cluster and migrate the data to a Hadoop Distributed File System (HDFS) with a replication factor of 3.
3. Create an Amazon ElastiCache cluster and redirect all read-only traffic to the cluster. Set up the cluster to be deployed in three Availability Zones.
4. Create an Amazon DynamoDB table to replace the RDS instance and redirect all read-only traffic to the DynamoDB table. Enable DynamoDB Accelerator to offload traffic from the main table.

Answer 3

1. Create RDS read replicas and redirect read-only traffic to the read replica endpoints. Enable a Multi-AZ deployment

not handle the new load + resource exhaustion = performance issues = read replicas

Question 4

A company is looking for a solution that can store video archives in AWS from old news footage. The company needs to minimize costs and will rarely need to restore these files. When the files are needed, they must be available in a maximum of five minutes.
What is the MOST cost-effective solution?

1. Store the video archives in Amazon S3 Glacier and use Expedited retrievals.
2. Store the video archives in Amazon S3 Glacier and use Standard retrievals.
3. Store the video archives in Amazon S3 Standard-Infrequent Access (S3 Standard-IA).
4. Store the video archives in Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA).

Answer 4

1. Store the video archives in Amazon S3 Glacier and use Expedited retrievals.

must be available in a maximum of five minutes = S3 Glacier and use Expedited retrievals

rarely need to restore = Glacier

Question 5

A company has created a VPC with multiple private subnets in multiple Availability Zones (AZs) and one public subnet in one of the AZs. The public subnet is used to launch a NAT gateway. There are instances in the private subnets that use a NAT gateway to connect to the internet. In case of an AZ failure, the company wants to ensure that the instances are not all experiencing internet connectivity issues and that there is a backup plan ready.
Which solution should a solutions architect recommend that is MOST highly available?

1. Create a new public subnet with a NAT gateway in the same AZ. Distribute the traffic between the two NAT gateways.
2. Create an Amazon EC2 NAT instance in a new public subnet. Distribute the traffic between the NAT gateway and the NAT instance.
3. Create public subnets in each AZ and launch a NAT gateway in each subnet. Configure the traffic from the private subnets in each AZ to the respective NAT gateway.
4. Create an Amazon EC2 NAT instance in the same public subnet. Replace the NAT gateway with the NAT instance and associate the instance with an Auto Scaling group with an appropriate scaling policy.

Answer 5

3. Create public subnets in each AZ and launch a NAT gateway in each subnet. Configure the traffic from the private subnets in each AZ to the respective NAT gateway.

MOST highly available = multi AZ = each AZ

Question 6

A healthcare company stores highly sensitive patient records. Compliance requires that multiple copies be stored in different locations. Each record must be stored for 7 years. The company has a service level agreement (SLA) to provide records to government agencies immediately for the first 30 days and then within 4 hours of a request thereafter.
What should a solutions architect recommend?

1. Use Amazon S3 with cross-Region replication enabled. After 30 days, transition the data to Amazon S3 Glacier using lifecycle policy.
2. Use Amazon S3 with cross-origin resource sharing (CORS) enabled. After 30 days, transition the data to Amazon S3 Glacier using a lifecycle policy.
3. Use Amazon S3 with cross-Region replication enabled. After 30 days, transition the data to Amazon S3 Glacier Deep Achieve using a lifecycle policy.
4. Use Amazon S3 with cross-origin resource sharing (CORS) enabled. After 30 days, transition the data to Amazon S3 Glacier Deep Archive using a lifecycle policy.

Answer 6

1. Use Amazon S3 with cross-Region replication enabled. After 30 days, transition the data to Amazon S3 Glacier using lifecycle policy.

be stored in different locations = cross-Region = 1,3

within 4 hours = not Deep that would take too long for 4 hour retrieval so.. = 1

7 years = Glacier

Question 7

A company recently deployed a new auditing system to centralize information about operating system versions, patching, and installed software for Amazon EC2 instances. A solutions architect must ensure all instances provisioned through EC2 Auto Scaling groups successfully send reports to the auditing system as soon as they are launched and terminated.
Which solution achieves these goals MOST efficiently?

1. Use a scheduled AWS Lambda function and execute a script remotely on all EC2 instances to send data to the audit system.
2. Use EC2 Auto Scaling lifecycle hooks to execute a custom script to send data to the audit system when instances are launched and terminated.
3. Use an EC2 Auto Scaling launch configuration to execute a custom script through user data to send data to the audit system when instances are launched and terminated.
4. Execute a custom script on the instance operating system to send data to the audit system. Configure the script to be executed by the EC2 Auto Scaling group when the instance starts and is terminated.

Answer 7

2. Use EC2 Auto Scaling lifecycle hooks to execute a custom script to send data to the audit system when instances are launched and terminated.

send reports to the auditing system as soon as they are launched and terminated = cant script on the instances = need external event triggers = Auto Scaling lifecycle hooks

Question 8

A company recently implemented hybrid cloud connectivity using AWS Direct Connect and is migrating data to Amazon S3. The company is looking for a fully managed solution that will automate and accelerate the replication of data between the on-premises storage systems and AWS storage services.
Which solution should a solutions architect recommend to keep the data private?

1. Deploy an AWS DataSync agent for the on-premises environment. Configure a sync job to replicate the data and connect it with an AWS service endpoint.
2. Deploy an AWS DataSync agent for the on-premises environment. Schedule a batch job to replicate point-in-time snapshots to AWS.
3. Deploy an AWS Storage Gateway volume gateway for the on-premises environment. Configure it to store data locally, and asynchronously back up point-in-time snapshots to AWS.
4. Deploy an AWS Storage Gateway file gateway for the on-premises environment. Configure it to store data locally, and asynchronously back up point-in-time snapshots to AWS.

Answer 8

1. Deploy an AWS DataSync agent for the on-premises environment. Configure a sync job to replicate the data and connect it with an AWS service endpoint.

fully managed solution = DataSync

keep the data private = endpoints

Question 9

A company has 150 TB of archived image data stored on-premises that needs to be moved to the AWS Cloud within the next month. The company’s current network connection allows up to 100 Mbps uploads for this purpose during the night only.
What is the MOST cost-effective mechanism to move this data and meet the migration deadline?

1. Use AWS Snowmobile to ship the data to AWS.
2. Order multiple AWS Snowball devices to ship the data to AWS.
3. Enable Amazon S3 Transfer Acceleration and securely upload the data.
4. Create an Amazon S3 VPC endpoint and establish a VPN to upload the data.

Answer 9

2. Order multiple AWS Snowball devices to ship the data to AWS.

MOST cost-effective = snowball

Question 10

A public-facing web application queries a database hosted on an Amazon EC2 instance in a private subnet. A large number of queries involve multiple table joins, and the application performance has been degrading due to an increase in complex queries. The application team will be performing updates to improve performance.
What should a solutions architect recommend to the application team? (Choose two.)

1. Cache query data in Amazon SQS
2. Create a read replica to offload queries
3. Migrate the database to Amazon Athena
4. Implement Amazon DynamoDB Accelerator to cache data.
5. Migrate the database to Amazon RDS

Answer 10

2. Create a read replica to offload queries
3. Migrate the database to Amazon RDS

queries = read replicas

multiple table joins = RDS = 3,5 (not 3 though because s3 static data is not good for database CRUD)

Question 11

A company is seeing access requests by some suspicious IP addresses. The security team discovers the requests are from different IP addresses under the same CIDR range.
What should a solutions architect recommend to the team?

1. Add a rule in the inbound table of the security to deny the traffic from that CIDR range.
2. Add a rule in the outbound table of the security group to deny the traffic from that CIDR range.
3. Add a deny rule in the inbound table of the network ACL with a lower number than other rules.
4. Add a deny rule in the outbound table of the network ACL with a lower rule number than other rules.

Answer 11

3. Add a deny rule in the inbound table of the network ACL with a lower number than other rules.

CIDR rules = network ACL

protection = inbound

Question 12

A company recently expanded globally and wants to make its application accessible to users in those geographic locations. The application is deployed on Amazon EC2 instances behind an Application Load Balancer in an Auto Scaling group. The company needs the ability shift traffic from resources in one region to another.
What should a solutions architect recommend?

1. Configure an Amazon Route 53 latency routing policy.
2. Configure an Amazon Route 53 geolocation routing policy.
3. Configure an Amazon Route 53 geoproximity routing policy.
4. Configure an Amazon Route 53 multivalue answer routing policy.

Answer 12

3. Configure an Amazon Route 53 geoproximity routing policy.

shift traffic from resources = geoproximity

shift traffic from users = geolocation

Question 13

A company wants to replicate its data to AWS to recover in the event of a disaster. Today, a system administrator has scripts that copy data to a NFS share. Individual backup files need to be accessed with low latency by application administrators to deal with errors in processing.
What should a solutions architect recommend to meet these requirements?

1. Modify the script to copy data to an Amazon S3 bucket instead of the on-premises NFS share.
2. Modify the script to copy data to an Amazon S3 Glacier Archive instead of the on-premises NFS share.
3. Modify the script to copy data to an Amazon Elastic File System (Amazon EFS) volume instead of the on-premises NFS share.
4. Modify the script to copy data to an AWS Storage Gateway for File Gateway virtual appliance instead of the on-premises NFS share.

Answer 13

4. Modify the script to copy data to an AWS Storage Gateway for File Gateway virtual appliance instead of the on-premises NFS share.

On Premise access by admins with low latency = Storage Gateway for File Gateway

backup = Storage Gateway

Question 14

An application requires a development environment (DEV) and production environment (PROD) for several years. The DEV instances will run for 10 hours each day during normal business hours, while the PROD instances will run 24 hours each day. A solutions architect needs to determine a compute instance purchase strategy to minimize costs.
Which solution is the MOST cost-effective?

1. DEV with Spot Instances and PROD with On-Demand Instances
2. DEV with On-Demand Instances and PROD with Spot Instances
3. DEV with Scheduled Reserved Instances and PROD with Reserved Instances
4. DEV with On-Demand Instances and PROD with Scheduled Reserved Instances

Answer 14

3. DEV with Scheduled Reserved Instances and PROD with Reserved Instances

DEV = 10 hours each day during normal business hours = scheduled = answer 3

Question 15

A company runs multiple Amazon EC2 Linux instances in a VPC with applications that use a hierarchical directory structure. The applications need to rapidly and concurrently read and write to shared storage.
How can this be achieved?

1. Create an Amazon Elastic File System (Amazon EFS) file system and mount it from each EC2 instance.
2. Create an Amazon S3 bucket and permit access from all the EC2 instances in the VPC.
3. Create a file system on an Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS SSD (io1) volume. Attach the volume to all the EC2 instances.
4. Create file systems on Amazon Elastic Block Store (Amazon EBS) volumes attached to each EC2 instance. Synchronize the Amazon Elastic Block Store (Amazon EBS) volumes across the different EC2 instances.

Answer 15

1. Create an Amazon Elastic File System (Amazon EFS) file system and mount it from each EC2 instance.

concurrent read and write = EFS

Linux = EFS

Question 16

A solutions architect observes that a nightly batch processing job is automatically scaled up for 1 hour before the desired Amazon EC2 capacity is reached. The peak capacity is the same every night and the batch jobs always start at 1 AM. The solutions architect needs to find a cost-effective solution that will allow for the desired EC2 capacity to be reached quickly and allow the Auto Scaling group to scale down after the batch jobs are complete.
What should the solutions architect do to meet these requirements?

1. Increase the minimum capacity for the Auto Scaling group.
2. Increase the maximum capacity for the Auto Scaling group.
3. Configure scheduled scaling to scale up to the desired compute level.
4. Change the scaling policy to add more EC2 instances during each scaling operation.

Answer 16

3. Configure scheduled scaling to scale up to the desired compute level.

nightly batch processing job = scheduled

Question 17

A Solutions Architect must design a web application that will be hosted on AWS, allowing users to purchase access to premium, shared content that is stored in an S3 bucket. Upon payment, content will be available for download for 14 days before the user is denied access.
Which of the following would be the LEAST complicated implementation?

1. Use an Amazon CloudFront distribution with an origin access identity (OAI). Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design a Lambda function to remove data that is older than 14 days.
2. Use an S3 bucket and provide direct access to the file. Design the application to track purchases in a DynamoDB table. Configure a Lambda function to remove data that is older than 14 days based on a query to Amazon DynamoDB.
3. Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design the application to set an expiration of 14 days for the URL.
4. Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design the application to set an expiration of 60 minutes for the URL and recreate the URL as necessary.

Answer 17

3. Use an Amazon CloudFront distribution with an OAI. Configure the distribution with an Amazon S3 origin to provide access to the file through signed URLs. Design the application to set an expiration of 14 days for the URL.

content will be available for download for 14 days = time window access = s3 signed URLs = 1,3,4

not 1 because it removes data

not 4 because time 60 minute window is wrong

so 3

Question 18

A solutions architect is designing a mission-critical web application. It will consist of Amazon EC2 instances behind an Application Load Balancer and a relational database. The database should be highly available and fault tolerant.
Which database implementations will meet these requirements? (Choose two.)

1. Amazon Redshift
2. Amazon DynamoDB
3. Amazon RDS for MySQL
4. MySQL-compatible Amazon Aurora Multi-AZ
5. Amazon RDS for SQL Server Standard Edition Multi-AZ

Answer 18

4. MySQL-compatible Amazon Aurora Multi-AZ
5. Amazon RDS for SQL Server Standard Edition Multi-AZ

highly available = multi-AZ

Question 19

A company’s web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only.
Which configuration will meet this requirement?

1. Configure the security group for the EC2 instances.
2. Configure the security group on the Application Load Balancer.
3. Configure AWS WAF on the Application Load Balancer in a VPC.
4. Configure the network ACL for the subnet that contains the EC2 instances.

Answer 19

3. Configure AWS WAF on the Application Load Balancer in a VPC.

one specific country only = WAF geo restrictions

Question 20

A solutions architect has created two IAM policies: Policy1 and Policy2. Both policies are attached to an IAM group (see image).

A cloud engineer is added as an IAM user to the IAM group. Which action will the cloud engineer be able to perform?

1. Deleting IAM users
2. Deleting directories
3. Deleting Amazon EC2 instances
4. Deleting logs from Amazon CloudWatch Logs

Answer 20

3. Deleting Amazon EC2 instances

ds = directory service